Skip to content

REF-31: Verify revocation data before trusting it #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thomasnymand merged 7 commits into from
Sep 2, 2026
Merged

REF-31: Verify revocation data before trusting it #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
8fbcd88
REF-31: Verify revocation data before trusting it
thomasnymand Aug 13, 2026
7d84fa2
Improved certificate validation, only fallback to CRL if OCSP validat…
thomasnymand Sep 1, 2026
de845a4
Merge branch 'master' into feature/REF-31-revocation-hardening
thomasnymand Sep 1, 2026
b0cf392
Bump lombok in idp demo.
thomasnymand Sep 1, 2026
41c464f
Use ConcurrentHashMap for issuing CA certificates.
thomasnymand Sep 1, 2026
1c0c4b1
Removed unused parameter in checkCertificates()
thomasnymand Sep 1, 2026
3065575
Fixed indention in pom-files.
thomasnymand Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion demo/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<artifactId>oiosaml3-demo</artifactId>
<name>OIOSAML Demo for Java v3</name>
<modelVersion>4.0.0</modelVersion>
Expand Down
22 changes: 21 additions & 1 deletion idp/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>dk.digst</groupId>
<artifactId>oiosaml3-idp</artifactId>
Expand All @@ -9,6 +10,9 @@
<properties>
<java.version>11</java.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<!-- Overrides the 1.18.16 of the Spring Boot parent, which predates the JDK 16 encapsulation of the
compiler internals it reaches into and so generates nothing on a current JDK -->
<lombok.version>1.18.46</lombok.version>
</properties>

<parent>
Expand Down Expand Up @@ -96,6 +100,22 @@

<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<!-- Names the processor explicitly, because a JDK 23 and later javac no longer runs the
annotation processors it finds on the classpath -->
<annotationProcessorPaths>
<path>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<version>${lombok.version}</version>
</path>
</annotationProcessorPaths>
</configuration>
</plugin>

<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
Expand Down
3 changes: 2 additions & 1 deletion integrationtest/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<artifactId>oiosaml3-integrationtest</artifactId>
<name>OIOSAML Integrationtest Java v3</name>
<modelVersion>4.0.0</modelVersion>
Expand Down
61 changes: 34 additions & 27 deletions oiosaml/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>dk.digst</groupId>
<artifactId>oiosaml3.java</artifactId>
Expand Down Expand Up @@ -37,30 +37,29 @@
<java.version>1.8.0</java.version>
<maven.deploy.skip>false</maven.deploy.skip>
</properties>

<profiles>
<profile>
<id>sign</id>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>1.5</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>

</profile>
<profile>
<id>sign</id>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>1.5</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>


Expand All @@ -87,7 +86,7 @@
<downloadJavadocs>true</downloadJavadocs>
</configuration>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
Expand All @@ -101,7 +100,7 @@
</execution>
</executions>
</plugin>

<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
Expand Down Expand Up @@ -175,6 +174,14 @@
<version>2.3.9</version>
</dependency>

<!-- Used by the tests to mint a CA, certificates and CRLs, bcprov itself comes in through OpenSAML -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.59</version>
<scope>test</scope>
</dependency>

<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
Expand Down
8 changes: 4 additions & 4 deletions oiosaml/src/main/java/dk/gov/oio/saml/model/IdPMetadata.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,22 +179,22 @@ private void doRevocationCheck() throws ExternalException, InternalException {
if (lastCRLCheck == null || (lastUpdate != null && lastUpdate.isAfter(lastCRLCheck))) {
try {
// Encryption
Set<X509Certificate> validEncryptionCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.ENCRYPTION), getLastCRLCheck());
Set<X509Certificate> validEncryptionCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.ENCRYPTION));
this.validEncryptionCertificates.clear();
if (validEncryptionCertificates != null) {
this.validEncryptionCertificates.addAll(validEncryptionCertificates);
}

// Signing
Set<X509Certificate> validSigningCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.SIGNING), getLastCRLCheck());
Set<X509Certificate> validSigningCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.SIGNING));
this.validSigningCertificates.clear();
if (validSigningCertificates != null) {
this.validSigningCertificates.addAll(validSigningCertificates);
}

// Unspecified
Set<X509Certificate> validUnspecifiedCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.UNSPECIFIED), getLastCRLCheck());
Set<X509Certificate> validNullCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(null), getLastCRLCheck());
Set<X509Certificate> validUnspecifiedCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(UsageType.UNSPECIFIED));
Set<X509Certificate> validNullCertificates = CRLChecker.checkCertificates(getAllX509CertificatesWithUsageType(null));
this.validUnspecifiedCertificates.clear();

if (validUnspecifiedCertificates != null) {
Expand Down
Loading
Loading